J3.x

Joomla 3.9.3 Security Notes

From Joomla! Documentation

Revision as of 23:44, 16 April 2019 by Sandra97 (talk | contribs) (Marked this version for translation)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Other languages:
Deutsch • ‎English • ‎Nederlands • ‎français • ‎italiano • ‎svenska • ‎Ελληνικά

.htaccess and web.config Security Update[edit]

Since Joomla 3.9.3, Joomla is shipped with additional security hardenings in the default htaccess.txt and web.config.txt files. These hardenings disable the so called MIME-type sniffing feature in web browsers. The sniffing leads to specific attack vectors, where scripts in normally harmless file formats (i.e. images) will be executed, leading to Cross-Site-Scripting vulnerabilities. The Joomla Security Strike Team recommends to manually apply the necessary changes to existing .htaccess or web.config files, as those files can not be updated automatically.

Changes for .htaccess[edit]

'For Apache Web Servers' Add the following lines before ## Mod_rewrite in use:

<IfModule mod_headers.c>
Header always set X-Content-Type-Options "nosniff"
</IfModule>

Changes for web.config[edit]

For Microsoft IIS Web Server Add the following lines right after </rewrite>:

<httpProtocol>
  <customHeaders>
    <add name="X-Content-Type-Options" value="nosniff" />
  </customHeaders>
</httpProtocol>

Changes for Nginx[edit]

For Nginx Web Server In case you are using Nginx webserver, add the following parameter under the server block in your Nginx configuration /etc/nginx/nginx.confː

http {
  add_header X-Content-Type-Options nosniff;
}